Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-10536: libcurl HTTP/2 Stream Dependency Data Leak
CURL-CVE-2026-10536
CVE-2026-10536
CVE-2026-10536
Summary
A security issue exists in libcurl's HTTP/2 feature when resetting a connection. If an application uses this feature and then closes the connection, sensitive data may be leaked. To fix this, update to the latest version of libcurl to ensure you have the necessary security patches.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| curl | curl | <= 8.20.0 |
| haxx | curl |
>= 7.88.0, < 8.21.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
Original title
A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or
`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `cu...
Original description
A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or
`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and
finally terminates the handle with `curl_easy_cleanup()`. During this final
cleanup phase, libcurl attempts to access and modify an internal structure
that was already freed during the reset operation.
configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or
`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and
finally terminates the handle with `curl_easy_cleanup()`. During this final
cleanup phase, libcurl attempts to access and modify an internal structure
that was already freed during the reset operation.
Vulnerability type
CWE-416
Use After Free
Published: 3 Jul 2026 · Updated: 23 Jul 2026 · First seen: 24 Jun 2026